Extracted

• • Target

    31aa264e905e9c51abecc1373e82207e_JaffaCakes118

  • Size

    73KB

  • MD5

    31aa264e905e9c51abecc1373e82207e

  • SHA1

    fecdb5cc97fce6a482b2cb081c1d172ade8d0d7e

  • SHA256

    e9a4a6fd59c233b63d0d655f12c52738026c2cbb855a6f3fe6722cbdefcd9af6

  • SHA512

    d05cd1c691c6b5c94c78b8cc569226f1657d8040a85a82e5a7088a57f56b6787db900ca042d3b19ca9456639ead24514b1b699fe7cd467144af4ab96643dca0e

  • SSDEEP

    1536:+xJ8QI7PitLk1mJi7pabGR/LpIedAesNIiGAMNBjG8cRxXACNs9lG7hucXwl:e8DTiW1mJi7MGtDwMNBi8cr+ohpC

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2